Re: [PATCH bpf-next 13/18] selftests/bpf: Add verifier tests for stack argument validation

bot+bpf-ci
2026-04-24T17:48:08Z

[-- Attachment #1: Type: text/plain, Size: 2453 bytes --]

> diff --git a/tools/testing/selftests/bpf/progs/verifier_stack_arg.c b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
> new file mode 100644
> index 000000000000..6b596ad63774
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/verifier_stack_arg.c
> @@ -0,0 +1,456 @@

[ ... ]

> +SEC("tc")
> +__description("stack_arg: pruning with different stack arg types")
> +__failure
> +__flag(BPF_F_TEST_STATE_FREQ)
> +__msg("invalid mem access 'scalar'")
> +__naked void stack_arg_pruning_type_mismatch(void)
> +{
> + asm volatile (
> + "call %[bpf_get_prandom_u32];"
> + "r6 = r0;"
> + /* local = 0 on program stack */
> + "r7 = 0;"
> + "*(u64 *)(r10 - 8) = r7;"
> + /* Branch based on random value */
> + "if r6 s> 3 goto l0_%=;"
> + /* Path 1: store stack pointer to outgoing arg6 */
> + "r1 = r10;"
> + "r1 += -8;"
> + "*(u64 *)(r11 - 8) = r1;"
> + "goto l1_%=;"
> + "l0_%=:"
> + /* Path 2: store scalar to outgoing arg6 */
> + "*(u64 *)(r11 - 8) = 42;"
> + "l1_%=:"
> + /* Call subprog that dereferences arg6 */
> + "r1 = r6;"
> + "r2 = 0;"
> + "r3 = 0;"
> + "r4 = 0;"
> + "r5 = 0;"
> + "call subprog_deref_arg6;"
> + "exit;"
> + :: __imm(bpf_get_prandom_u32)
> + : __clobber_all
> + );
> +}

Does the error message string match the expected register output?

During v6 review, sashiko-bot raised a concern about test fragility:
since subprog_deref_arg6 is standard C (not __naked), LLVM determines
which register is used to dereference f. If a future LLVM version
chooses a different register, the verifier error will mention that
register instead of R1, causing the test to fail.

You acknowledged the issue and said you would use a regex like
__msg("R{{[0-9]}} invalid mem access 'scalar'") to match the register
dynamically. However, the current code uses __msg("invalid mem access
'scalar'") without any register prefix.

The same pattern appears in stack_arg_release_ref,
stack_arg_stale_pkt_ptr, and stack_arg_null_propagation_fail. Should
these tests use the regex pattern to avoid compiler-dependent failures,
or be rewritten to make subprog_deref_arg6 a __naked function?

Reference:
https://lore.kernel.org/bpf/20260419172100.A89FEC2BCAF@smtp.kernel.org/

[ ... ]

---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/24902767240